Re: Pressing ESC from "PXE windows Boot manager" causes ASSERT

["Wu, Jiaxin" <jiaxin.wu@intel.com>]

Karunakar,

Can you share us the detailed DHCP and WDS configuration? E.g. DHCP options / WDS Properties (DHCP).  As you know, the different DHCP/WDS configuration may lead to the different PXE download process/behavior. We would like to reproduce the issue first.

>From your below debug messages, the issue seems to be triggered by bootmgfw.Entry.

Thanks,
Jiaxin

> -----Original Message-----
> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of
> Karunakar P
> Sent: Thursday, May 25, 2017 2:38 PM
> To: afish@apple.com; edk2-devel@lists.01.org
> Cc: Ye, Ting <ting.ye@intel.com>
> Subject: Re: [edk2] Pressing ESC from "PXE windows Boot manager" causes
> ASSERT
> 
> Hello All,
> 
> I've added some traces to narrow down the issue.
> 
> Once the NBP file downloaded, control will be given to it.
> I've added some traces before StartImage() and after StartImage() call.
> 
> Following are the debug messages
> 
> // DEBUG message printed before StartImage()
> // StartImage() called
> wdsmgfw.Entry(100061C0)
> WDS Boot Manager version 0800
> Client IP: 192.168.0.6
> Server IP: 192.168.0.1
> Server Name: WIN-8PL637590SS
> Press ENTER for network boot service.
> Windows Deployment Services (Server IP: 192.168.0.1)
> Contacting Server (192.168.0.1):
> ESC=Exit -ConvertPages: Incompatible memory types
> bootmgfw.Entry(849FE1C0)
> ASSERT d:\PathtoProject\MdeModulePkg\Core\Dxe\Mem\Pool.c(561): CR has
> Bad Signature
> 
> It might be Boot Loader Issue, As control is NOT coming back.
> 
> Could you please help on this.
> 
> Thanks,
> karunakar
> 
> -----Original Message-----
> From: afish@apple.com [mailto:afish@apple.com]
> Sent: Wednesday, May 24, 2017 8:39 PM
> To: Karunakar P
> Cc: Ye, Ting; edk2-devel@lists.01.org
> Subject: Re: [edk2] Pressing ESC from "PXE windows Boot manager" causes
> ASSERT
> 
> Karunakar,
> 
> Every Pool allocation has a header and a tail data structure that is outside of
> the user visible data. Both these structures have signatures. The ASSERT you
> are seeing is a bad signature in the header so that looks like a buffer underflow.
> It could also be a use after free bug.
> 
> Head:
> POOL_HEAD
> Buffer:
> User Data
> Tail:
> POOL_TAIL
> 
> Given the checks only happen on Free it is possible it could be a buffer overflow
> on a buffer that has not yet been freed that runs into this buffer.
> 
> If you have a debugger dumping the memory before and after the buffer can
> some times be useful. The pattern might give you some clues.
> 
> Thanks,
> 
> Andrew Fish
> 
> > On May 23, 2017, at 10:16 PM, Karunakar P <karunakarp@amiindia.co.in>
> wrote:
> >
> > Hello All,
> >
> > The ASSERT happens in the following function
> >
> > /**
> >  Internal function to free a pool entry.
> >  Caller must have the memory lock held
> >
> >  @param  Buffer                 The allocated pool entry to free
> >  @param  PoolType               Pointer to pool type
> >
> >  @retval EFI_INVALID_PARAMETER  Buffer not valid
> >  @retval EFI_SUCCESS            Buffer successfully freed.
> >
> > **/
> > EFI_STATUS
> > CoreFreePoolI (
> >  IN VOID               *Buffer,
> >  OUT EFI_MEMORY_TYPE   *PoolType OPTIONAL
> >  )
> > {
> > .
> > .
> > ASSERT(Buffer != NULL);
> >  //
> >  // Get the head & tail of the pool entry  //
> >  Head = CR (Buffer, POOL_HEAD, Data, POOL_HEAD_SIGNATURE);	//
> ASSERT happens here
> >  ASSERT(Head != NULL);
> > .
> > .
> > }
> >
> > We are using NetworkPkg: SHA-
> ef810bc807188224a752ffbcf5e7f4b651291cee
> >
> > I think  here I'm unable attach the files.
> > You can find the attached screenshots in the following Bug571
> > https://bugzilla.tianocore.org/show_bug.cgi?id=571
> >
> > Thanks,
> > Karunakar
> >
> >
> > -----Original Message-----
> > From: Ye, Ting [mailto:ting.ye@intel.com]
> > Sent: Wednesday, May 24, 2017 10:29 AM
> > To: Karunakar P; edk2-devel@lists.01.org
> > Subject: RE: Pressing ESC from "PXE windows Boot manager" causes
> > ASSERT
> >
> > Hi Karunakar,
> >
> > Sorry I did not find your attached files. Would you please send them again?
> Besides that, do you mind telling us which code base are you using for PXE boot?
> Are you using some revision of EDKII main trunk or UDK release?
> >
> > Thanks,
> > Ting
> >
> > -----Original Message-----
> > From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of
> > Karunakar P
> > Sent: Wednesday, May 24, 2017 12:20 PM
> > To: edk2-devel@lists.01.org
> > Subject: [edk2] Pressing ESC from "PXE windows Boot manager" causes
> > ASSERT
> >
> > Hi All,
> >
> > We have facing an issue with PXE boot.
> > [Issue]
> > When ESC is pressed from Windows Boot manager during PXE boot (IPv4 or
> > IPv6) system Hangs with following ASSERT
> >
> > ASSERT [DxeCore] \MdeModulePkg\Core\Dxe\Mem\Pool.c : CR has Bad
> > Signature
> >
> > [Reproduction Steps]
> > 1. Perform UEFI PXEv4 or UEFI PXEv6 boot 2. It will start PXE boot over IPv4/6
> and Downloads NBP file successfully.
> >   Attached the Screenshot for the same(ScreenShot1.jpg)
> >
> >   It will Displays the info like "Press ENTER for network boot service"
> >   Attached Screensho(ScreenShot2.jpg)
> >
> > 3. Press ENTER and then press ESC immediately to see the Windows Boot
> Manager Menu
> >   It will list the available Operating Systems
> >   Attached the screenshot(ScreenShot3.png)
> >
> > 4. Press ESC to come back to Setup or next Boot option
> >
> > [Result]
> > System hangs with ASSERT
> >
> > [Expected Result]
> > On pressing ESC from Windows Boot Manager, it should come back to
> > setup/Next boot option in boot order
> >
> > Note:
> > We have PXE server configured in Windows Server 2012 R2.
> >
> > Please look into it.
> >
> >
> > Thanks,
> > karunakar
> > _______________________________________________
> > edk2-devel mailing list
> > edk2-devel@lists.01.org
> > https://lists.01.org/mailman/listinfo/edk2-devel
> > _______________________________________________
> > edk2-devel mailing list
> > edk2-devel@lists.01.org
> > https://lists.01.org/mailman/listinfo/edk2-devel
> 
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel